Re: [PATCH] ksmbd: validate normalized name response length

[Namjae Jeon]

On Sat, Aug 29, 2026 at 3:27 PM Alon Shakevsky via B4 Relay
<devnull+shakevsky.berkeley.edu@xxxxxxxxxx> wrote:
>
> From: Alon Shakevsky <shakevsky@xxxxxxxxxxxx>
>
> FILE_NORMALIZED_NAME_INFORMATION converts the open file path to UTF-16.
> smb2_allocate_rsp_buf() leaves these responses in the 448-byte small
> buffer, and get_file_normalized_name_info() converts the path without
> checking the remaining space.
>
> An authenticated client can query a long path and make
> smbConvertToUTF16() write beyond work->response_buf.
>
> Use the large response buffer for normalized-name queries. Before
> conversion, verify that the response has room for the worst-case UTF-16
> output and its terminator.
>
> Fixes: 10aeff72ab82 ("ksmbd: support normalized name information")
> Assisted-by: Antiproof:GPT-5.6-Sol
> Signed-off-by: Alon Shakevsky <shakevsky@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!